When the code-read protection is enabled, the JTAG debug port and the external memory boot is disabled. In addition, you cannot read memory, write to RAM, execute the “go" command, copy RAM to Flash, or write port to RAM. These ISP commands terminate with the return code, CODE_READ_PROTECTION_ENABLED, if you try and execute any of the commands while the code-read protection is valid. The ISP "erase" command only allows erasure of all user sectors, not just one, when the code-read protection is enabled. This allows you to still reprogram the whole device, but it makes sure that the whole device is erased before you start reprogramming it. You cannot change the code-read protection without erasing the whole device. IAP commands are not affected by the code-read protection, so this still gives your program the control of being able to read and write from the program memory. But, it does not give anyone on the outside ability to read the code.